Details

Description

Currently we already have WebApplicationInvokingPipeline which makes it possible to delegate to other web application frameworks after the HST matching and some initial pipeline valve have been done.

However, this WebApplicationInvokingPipeline contains in the initializationValves and in the processingValves valves like cmsSecurityValve, securityValve, subjectBasedSessionValve, jcrSessionStatefulConcurrencyValve etc. This makes it problematic to use for example in combination with the hst-security module: What we need to support is the following:

Now, all URLs for /login will be redirected to https and all HstLink objects will start with https (if current scheme is http and not https). For example
<hst:link var="loginLink" path="/login/proxy"/> will create a link that starts with https if current request is not over http

The problem: If we now set

hst:namedpipeline = WebApplicationInvokingPipeline

we get problems during login because of the WebApplicationInvokingPipeline contains subjectBasedSessionValve : catch22

Instead, we need a pipeline which doesn't include subjectBasedSessionValve kind of valves, but is really basic. For that one, I want to add PlainFilterChainInvokingPipeline which is as follows: